Re: Monitor Computer/File Access

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 03/17/05 

Date: Wed, 16 Mar 2005 23:45:06 -0600

You can enable auditing on your computer and then look at the security log
in Event Viewer to see who has been logging onto or accessing your computer
over the network assuming you are a local administrator. Be sure to enable
auditing of logon events. If you suspect malicious activity make sure that
you change your passwords, check the membership of your local administrators
group and make sure that the guest account is disabled in Local Users and
Computers - lusrmgr.msc. If you have shares on your computer as shown with
the command " net share " that are other then default/remote admin/remote
IPC then any user with read access to those shares can copy files from that
share. The link below has more details. --- Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q300958

"Ty Archer" <TyArcher@discussions.microsoft.com> wrote in message
news:7851ACAE-6EEA-4D00-820A-E507DEC944C4@microsoft.com...
> Is there a way to find out if someone has been accessing my computer or
> copy
> files from my computer or just snooping around on my computer that is on a
> 2000 network. My OS is windows 2000 workstation.
>
> Thanks very much.

Relevant Pages

  • Re: Event Viewer Security log Access denied
    ... >>computer regarding the Security log in Event Viewer. ... > administrator account. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Deleted Files -Help!
    ... You would first need to enable auditing of object access on a computer and then ... Be sure to only audit for deletion ... Don't try to audit everything - just ... track files deletions in the Event Viewer in the future? ...
    (microsoft.public.win2000.security)
  • cant reboot - shutdown
    ... down or restart, even the local administrator. ... When the dialogue box ... In the event viewer we ... with an error that "There is no more space on disk" though there was space ...
    (microsoft.public.windows.server.setup)
  • Re: Log of Logons
    ... enable auditing and the look at event viewer ... > How would I go about either finding or creating a log of who's logging ...
    (microsoft.public.win2000.security)
  • Re: User Logon / Logoff
    ... Enable auditing of logon and logoff and view the information in the security ... logs in Event Viewer. ... I don't know exactly where it is enabled offhand since ...
    (microsoft.public.windows.server.security)